Hmm, well actually, I took a look at /dev/mem with bpe, and found the exact string located where EIP was pointing. The disassembly of the remainder of the call follows, if it clicks in anybody's mind...